General
- Target MALZ6.zip
- Size 17.8MB
- Sample250102-1ejbvswpcv
- SHA256 c858e10e29b769ca86445ba1bebdf708e88245da4e96c4afc967818e8293e099
Malware Config
Targets
-
- Target 客户端(Client)_KEY.exe
- Size 1.2MB
- SHA256 e182e12f86fcc70e57c6ed760c5789e6c1a08dac5b4bfb005509c1a7038e9990
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target UDP.exe
- Size 31KB
- SHA256 f73a89b6a5c42d21ee4f7a4d79ad784cdfd896bbe2453b60cf9688786f7a9d98
Score3/10 -
- Target a
- Size 1.3MB
- SHA256 dd77459b8d76d9be75dde3f2aa8e8434b266bc98acd15966c6ae65a6620b10db
Score8/10-
Writes memory of remote process
-
Loads a kernel module
Loads a Linux kernel module, potentially to achieve persistence
-
- Target arm1
- Size 977KB
- SHA256 8366aea8087a354cbd178f920770b35d785f988ec3649bb7e282d1e3272a6b77
Score4/10 -
- Target bj.exe
- Size 378KB
- SHA256 ca89debe5dff34c2e2f56875d7dcde5e47565329d3aeb2f2f4a6a3e2248fe664
Score10/10-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-
- Target bjyk.exe
- Size 378KB
- SHA256 ca89debe5dff34c2e2f56875d7dcde5e47565329d3aeb2f2f4a6a3e2248fe664
Score10/10-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-
- Target cctv.exe
- Size 221KB
- SHA256 744d37a30b3e0085b55fb62c9f226a4fd42a2545bd246105ba5e99c8fbfe1011
Score10/10-
Modifies firewall policy service
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Loads dropped DLL
-
- Target cctv_2.exe
- Size 48KB
- SHA256 71ef7e43615e286a5d424d2bafca90c03b05a1c216f1b3ac81997ee2d6bda8d7
Score10/10-
Modifies firewall policy service
-
- Target cn.exe
- Size 520KB
- SHA256 5b81c2781d2c953f46fa7fdd815a31eebdaf8d402ab96457814cdf87583eaf1d
Score7/10-
Executes dropped EXE
-
- Target cn1.exe
- Size 196KB
- SHA256 fe23577d1480bedcd63037921bbd5a55e86171c1a7dc97667df6a674ca0044fc
Score7/10-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
- Target dhl.exe
- Size 378KB
- SHA256 ca89debe5dff34c2e2f56875d7dcde5e47565329d3aeb2f2f4a6a3e2248fe664
Score10/10-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-
- Target java
- Size 1.5MB
- SHA256 59755333ce8c0e16e45340984a22a50f4cb6cb92f8fb85e452dfbec7596a4859
Score4/10 -
- Target java (2)
- Size 41KB
- SHA256 18b0893f3b143a70dc60b0d4da10b63f5fd172fedb63b857b281e0c19a0b0dbe
Score1/10 -
- Target java1
- Size 1.5MB
- SHA256 fc10540c1effe99bdd7a9e1025bdda6813f5dbbdb6e89acdbf79df443a5bba49
Score7/10-
Loads a kernel module
Loads a Linux kernel module, potentially to achieve persistence
-
- Target k5.exe
- Size 76KB
- SHA256 ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da
Score10/10-
Modifies firewall policy service
-
Modifies RDP port number used by Windows
-
Executes dropped EXE
-
- Target ly1
- Size 745KB
- SHA256 fe686bb110b6af61f109de5b71239bb76ea75e0588ece3a0570393f310eb1026
Score3/10 -
- Target mh.exe
- Size 92KB
- SHA256 22e44f753597c056b7b1eba9728043e7e6dbdf94f0f66f06e6bdd1fdba096fb2
Score10/10-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Modifies firewall policy service
-
Executes dropped EXE
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target mips
- Size 1.1MB
- SHA256 5d9f4ec734cf44f342a45f7de4ba0e208ec141ce47e32b3bc7d0666eff538fe5
Score4/10 -
- Target pjhxx
- Size 544KB
- SHA256 609a5f0e44f1723d29f258c4459a532b75c9c1b2bd26607384d17352150dd3a6
Score1/10 -
- Target rootkit
- Size 357KB
- SHA256 548d1e891b2837e28c6e495fd1e5788ab650d169c53ade1f0cadf005d8657316
Score8/10-
Modifies password files for system users/ groups
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE
-
OS Credential Dumping
Adversaries may attempt to dump credentials to use it in password cracking.
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Writes DNS configuration
Writes data to DNS resolver config file.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies rc script
Adding/modifying system rc scripts is a common persistence mechanism.
-
Write file to user bin folder
-
Writes file to system bin folder
-
- Target se.exe
- Size 96KB
- SHA256 589b185221797c8dc67bc586f8c2e3c463a06771e53744afa082c04be7fe5763
Score7/10-
Deletes itself
-
Executes dropped EXE
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Windows Service
1Modify Authentication Process
1Pluggable Authentication Modules
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Windows Service
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
1File Deletion
1Modify Authentication Process
1Pluggable Authentication Modules
1Modify Registry
1Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
3System Checks
1Credential Access
Adversary-in-the-Middle
1Modify Authentication Process
1Pluggable Authentication Modules
1OS Credential Dumping
1/etc/passwd and /etc/shadow
1